IdP: Returning emailAddress as NameId in SAMLResponse Assertion

[Kevin P. Foote]

On Thu, 21 Nov 2013, vyal2k wrote:

> Thanks. 
> I commented out the "AttributeFilterPolicy" for "transientId" AttributeRule and now there is no response from IdP and i see the following in idp-process.log:
>
> 21:34:27.889 - WARN [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:491] - No attribute of principal 'user1' can be encoded in to a NameIdentifier of required format 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress' for relying party 'https://inw00003973:8443'

So now you are back to getting your attribute-resolver fixed so one of
your attributes is properly encoded to the format you are trying to
deliver.

I'm guessing that the attribute you are trying to encode to the specific
format is not being populated for the user properly and therefor can not
be encoded correctly... Again just guessing.

You should also turn up logging to the level of "Debug" when testing
this stuff so many of these errors will bubble up so you can see them.


------
thanks
  kevin.foote